[pkg-gnupg-maint] Bug#1150168: gnupg2: CVE-2026-105712

[Andreas Metzler]

On 2026-10-06 Salvatore Bonaccorso <carnil at debian.org> wrote:
> Source: gnupg2
> Version: 2.4.9-7
> X-Debbugs-CC: team at security.debian.org
> Severity: important
> Tags: security upstream

> Hi,

> The following vulnerability was published for gnupg2.

> CVE-2026-105712[0]:
> | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted
> | data in an archive. When extracting an untrusted archive with
> | --directory (aka -C) into an existing directory containing a pre-
> | existing symlink, gpgtar can follow that symlink and create or
> | overwrite a file outside the selected extraction directory. The
> | write is limited by the extraction user's filesystem permissions. An
> | archive extracted into a fresh empty directory does not have this
> | risk.


> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
[...]

Good morning,

I suspect this is not worth a DSA?

cu Andreas
-- 
"You people are noisy," Nia said.
I made the gesture of agreement.